[SOLVED] Spam Being Sent Thru Server - Help Needed!

[jholder]

Originally Posted by msf004

The status and cause of this is a good question. I could never find anything in log files or otherwise. After further review, it did only happen to one account, not two like I originally thought. As I stated, that account literally does have the emails in their sent items with all recipients now in their address book. So the email was definitely sent through Zimbra. The individual DOES NOT use a Zimbra connectors, the indivudal uses a Mac, not a Windows PC, I could not find anything running on the Mac which was unusual, the user had a secured password, and I have not seen anymore instances of emails being sent. There has not been anymore problems.

However, I was concerned enough with the incident that I ended up opening a Zimbra support ticket for assistance. I received one reply from a Zimbra employee asking for log files and more information, to which I responded; however, I have not heard back from Zimbra since then, and I have even followed-up a few times.

Right now I am mostly concerned if this is going to cost me a support ticket being I opened a support ticket through Zimbra for assistance. I say this because, I have not received any support. I would be paying for something that didn't happen.

Hi Marc-
Just to follow up on your issue with support, my records indicate that Bill (Phoenix from the forums) replied to your e-mail on the 24th of August (You submitted the ticket on Aug 23rd 5:02PM).

Bill is a support engineer as well. Just in case you did not get his reply to your ticket, it was as follows:

Date: Fri, 24 Aug 2007 00:22:02 -0700 (PDT)
From: Bill Pye <bill.pye@zimbra.com>
To: mfussell@razor***.***, support@zimbra.com
Cc: support@zimbra.com


Hi

I've just replied to your recent post on the forum. Can you provide the information I've asked for and attach it to the case notes and I'll take a look at it as soon as I can.

Regards

Bill

Perhaps there was a problem receiving the e-mail? That can happen on systems that may have been compromised.

Please let us know what we can do to insure your issues get resolved.

Sincerely,
john

[msf004]

John,

I replied to Bill's emailed request for information via the support ticket system, not email. I just checked and my reply, along with my follow-ups, are still attached to the ticket.

Also, per the suggestion of mmorse, I just added another post to the support ticket asking if someone could examine my zcs/system setup for the possibility of open holes. This was a good suggestion by mmorse. If this can be done and nothing is found then I would think there is not much more that can be done and I would feel comfortable closing the support ticket.

I will wait to hear back and see what happens.

Thanks,
-Marc

[Andrew10AE]

Folks-

Just wanted to share that I had a similar problem and I diagnosed that a config got changed during an upgrade to 5.0, including my local subnet in the list of trusted hosts for the MTA...

This normally wouldn't be a problem for most folks, but if you happen to be SNATing the traffic going to the server, you end up with everyone in the trusted hosts, and thus, end up with an open relay...

In my case, the server is behind a BIGIP... that certainly doesn't REQUIRE a SNAT, but that is the best config in my case, so I decided to keep it...

so... two choices - REMOVE your local subnet from the trusted hosts lists (and make everyone authenticate - thats what I did), or remove the SNAT...

Regards,

Andrew